instanceof should not get the prototype for non-default HasInstance
https://bugs.webkit.org/show_bug.cgi?id=68656

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

Instanceof is currently implemented as a sequance of three opcodes:
    check_has_instance
    get_by_id(prototype)
    op_instanceof
There are three interesting types of base value that instanceof can be applied to:
    (A) Objects supporting default instanceof behaviour (functions, other than those created with bind)
    (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions)
    (C) Values that do not respond to the [[HasInstance]] trap.
Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are
two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for
hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly,
this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec
violation.

The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving
op_instanceof to handle only cases (A).

* API/JSCallbackObject.h:
(JSCallbackObject):
* API/JSCallbackObjectFunctions.h:
(JSC::::customHasInstance):
* API/JSValueRef.cpp:
(JSValueIsInstanceOfConstructor):
    - renamed hasInstance to customHasInstance
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump):
    - added additional parameters to check_has_instance opcode
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
    - added additional parameters to check_has_instance opcode
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitCheckHasInstance):
    - added additional parameters to check_has_instance opcode
* bytecompiler/BytecodeGenerator.h:
(BytecodeGenerator):
    - added additional parameters to check_has_instance opcode
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
    - added additional parameters to check_has_instance opcode
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
    - added additional parameters to check_has_instance opcode
* interpreter/Interpreter.cpp:
(JSC::isInvalidParamForIn):
(JSC::Interpreter::privateExecute):
    - Add handling for non-default instanceof to op_check_has_instance
* jit/JITInlineMethods.h:
(JSC::JIT::emitArrayProfilingSiteForBytecodeIndex):
    - Fixed no-LLInt no_DFG build
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emitSlow_op_check_has_instance):
    - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
    - no need to check for ImplementsDefaultHasInstance.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emitSlow_op_check_has_instance):
    - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
    - no need to check for ImplementsDefaultHasInstance.
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h:
    - Add handling for non-default instanceof to op_check_has_instance
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
    - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
* runtime/ClassInfo.h:
(MethodTable):
(JSC):
    - renamed hasInstance to customHasInstance
* runtime/CommonSlowPaths.h:
(CommonSlowPaths):
    - removed opInstanceOfSlow (this was whittled down to one function call!)
* runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::customHasInstance):
* runtime/JSBoundFunction.h:
(JSBoundFunction):
    - renamed hasInstance to customHasInstance, reimplemented.
* runtime/JSCell.cpp:
(JSC::JSCell::customHasInstance):
* runtime/JSCell.h:
(JSCell):
* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):
(JSC):
(JSC::JSObject::defaultHasInstance):
* runtime/JSObject.h:
(JSObject):

LayoutTests: 

* fast/js/function-bind-expected.txt:
    - check in passing result.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed windows build fix.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129282 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Forward-declare WebSize as a struct
https://bugs.webkit.org/show_bug.cgi?id=97381

Reviewed by James Robinson.

The mismatched "class" forward-declaration for WebSize in this file
will cause a Clang error when it's included in Chromium.

* chromium/public/WebCompositorSoftwareOutputDevice.h:
(WebKit):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r129176): Incorrect line breaking when kerning occurs between a space and the following character
https://bugs.webkit.org/show_bug.cgi?id=97377

Reviewed by Enrica Casucci.

Source/WebCore: 

Test: fast/text/kerning-with-TextLayout.html

When kerning is enabled, the last character in a word may have its advance shortened because
of its trailing space. To account for that, words are measured along with the trailing space,
then the width of a space is subtracted from the result. This doesn’t work when the trailing
space itself has its advance shortened due to the character following it, which can happen
when using the TextLayout optimization. However, when the optimization is used, the advance
of the last character of the word is already adjusted for the trailing space, so there is no
need to measure with that space and subtract its advance.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::nextLineBreak): Changed to not use the trailingSpaceWidth
mechanism when TextLayout is being used.

LayoutTests: 

* fast/text/kerning-with-TextLayout-expected.html: Added.
* fast/text/kerning-with-TextLayout.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129284 268f45cc-cd09-0410-ab3c-d52691b4dbfc
nrwt: don't require additional-platform-directory to be an abspath or live under LayoutTests
https://bugs.webkit.org/show_bug.cgi?id=97380

Reviewed by Ojan Vafai.

There doesn't seem to be a good reason for this restriction and
it's useful to be able to point to directories outside the
checkout for results (e.g., for local failures due to a 10.7.4
install ;).

* Scripts/webkitpy/layout_tests/port/base.py:
(Port.relative_test_filename):
(Port.relative_perf_test_filename):
* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidDriver._command_from_driver_input):
* Scripts/webkitpy/layout_tests/run_webkit_tests.py:
(_set_up_derived_options):
* Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
(MainTest.test_additional_platform_directory):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129285 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix WebKit2 sandbox profile.

Instead of using #pragmas, just disable all warnings in DerivedSources.make. I suspect
that passing -traditional to the preprocessor disables support for #pragmas but I'm afraid
to change it to something else.

* DerivedSources.make:
* WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129286 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove redundant argument to op_instanceof
https://bugs.webkit.org/show_bug.cgi?id=97382

Reviewed by Geoff Garen.

No longer needed after my last change.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump):
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitInstanceOf):
* bytecompiler/BytecodeGenerator.h:
(BytecodeGenerator):
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove bogus assertions from ChildListMutationScope
https://bugs.webkit.org/show_bug.cgi?id=97372

Reviewed by Ryosuke Niwa.

Source/WebCore:

Some asserts (and their accompanying comment) were trying to enforce
proper usage of ChildListMutationScope from WebCore, but in the
presence of MutationEvents they could fail due to arbitrary script
execution.

This change gets rid of those asserts and adds tests exercising
the (pre-existing) codepaths for handling these out-of-order cases.
Without this patch, these tests ASSERT in debug builds.

Tests: fast/mutation/added-out-of-order.html
       fast/mutation/removed-out-of-order.html

* dom/ChildListMutationScope.cpp:
(WebCore::ChildListMutationAccumulator::childAdded):
(WebCore::ChildListMutationAccumulator::willRemoveChild):
* dom/ChildListMutationScope.h:
(WebCore):

LayoutTests:

* fast/mutation/added-out-of-order-expected.txt: Added.
* fast/mutation/added-out-of-order.html: Added.
* fast/mutation/removed-out-of-order-expected.txt: Added.
* fast/mutation/removed-out-of-order.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129288 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pedantic test in Mozilla's JavaScript test suite fails. function-001.js function-001-n.js
https://bugs.webkit.org/show_bug.cgi?id=27219

Reviewed by Sam Weinig.

These tests are just wrong.
See ECMA 262 A.5, FunctionDelcaration does not require a semicolon.

* tests/mozilla/expected.html:
* tests/mozilla/js1_2/function/function-001-n.js:
* tests/mozilla/js1_3/Script/function-001-n.js:
* tests/mozilla/js1_3/regress/function-001-n.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129289 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed windows build fix.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129290 268f45cc-cd09-0410-ab3c-d52691b4dbfc